SSL/TLS enablement for DDM IBM i to IBM i

In this example I have two IBM I systems:  JERRYLABA and JERRYLABB.
JERRYLABA (10.15.2.151) is the AR system.
JERRYLABB (10.15.2.160) is the AS system.

Note:
Keep in mind that the team that supports DDM/DRDA doesn’t support DCM.  If you need help inside DCM or importing or exporting a certificate, please open a new case.
This example case will walk through setting up DCM from scratch using a self-signed certificate.
Then setting up DDM to use SSL/TLS along with testing the connection.
I will be using ACS Base and Navigator for I to get to the DCM link.  These two products again are not supported by this team, please open a case for questions or problems with either of those two products.
This document assumes a functioning system.

Open the main ACS GUI and click the Navigator for I link.
Select the AS system from the drop down and click the link to Navigator for i:

This will open the PC’s default web browser to the Navigator for I interface.
Use a secofr based profile or QSECOFR to log in:

Once logged in, hover over the Bookmarks icon and select IBM Digital Certificate Manager for i:

Log into DCM using the same credentials as you did with navigator for i:

Select the option to Create Certificate Store:

Select Local CA:

Provide a password for the Local CA store.  This can be whatever you would like:

Select Create:

Then fill in the required fields and make any changes you may need.  Click Create:

The new CA will be displayed:

Next, a Server certificate will be created.
Click on the home button:

Click create Certificate store:

Select *System:

Provide a password for the *System store, again anything you want, and press Create:

Press the Create button in the system store we just created:

Select Local CA for the CA type:

Make sure you have selected the Local CA you just created from the drop-down:

Continue filling out the required fields and optional fields, press create button when done:

Note: I changed my common name from the CA, the certificate fails validation even though it creates.

The new System Certificate will be shown:

At this point you should now have a CA and an associated Server certificate created to use.
It’s time to assign the Server certificate to the DDM/DRDA application.

With the *System store selected, click on the Manage Application definition link:

Locate the DDM/DRDA application and click view:

Click Assign Certificates:

Check the checkbox beside the certificate you just created and press Assign:

Once assign, click the back button:

Notice that the certificate now shows up on the DDM/DRDA application:

Now we will recycle the DDM server via an ACS 5250 session for the AS system:

ENDTCPSVR *DDM
STRTCPSVR *DDM

Then check in NETSTAT *CNN for the SSL/TLS enabled port 448.

NETSTAT *CNN

Press SHIFT+F3 (F15)
Enter port 448 for Local port range, Lower value.
Press the enter key twice.
This is what you’ll see:

Once that is confirmed, it’s back to DCM on the AS system still.
Now the CA must be exported from the AS system for the AR server import of this CA.
Open or select the Local CA store and click view on the local CA you just created:

Select Export:

Select Downloads and give the CA file a name.  The name can be whatever, but use a .cer extension.
This example uses ca.cer.  Press Export:

Select Download Certificate:

Select download on the file you just created:

You’ll be prompted to save the file on your PC.  Place it somewhere you can find it and click save:

Now it’s time to import that CA to the AR system.
You may want to follow all the above steps to setup the AR system to be an AS server.
It will be required for DCM to be setup on the AR system prior to following these instructions.

On the AR system, select open Certificate Store.

Select the *System store:

Enter the *System stores password and press Open:

Click on the Upload Certificate and then the Browse:

This opens a PC file dialog, browse to the path of the exported CA and select it.  Click the open button:

Click Upload:

Go back to the *System store and click Browse uploads:

Select the CA you just uploaded and click the select link:

Press the Continue Button:

Give it a label, this can be whatever you want, then press Import:

If there is a filter applied (there is by default), this can be removed so you can see the CA you just imported.  Just press the x to remove:

Here is the view with no filter:

Note:
You can click the filter icon and then select Server/Client certificate to add the filter back in if needed.
At this time, all the DCM operation is completed.
Now we can work on configuration on the IBM I side.

On the client side, the AR system, we must create a relational database entry that says we are using SSL and port 448. 
The command for my system will be this:

ADDRDBDIRE RDB(JERRYLABB) RMTLOCNAME('10.15.2.160' *IP) PORT(448) SECCNN(*SSL)

Next, on the AS system we must have a matching relational database entry name.
I have an existing *local entry, but it doesn’t match what I called it on the AR system.
So I will create an alias with that name as follows:

ADDRDBDIRE RDB(JERRYLAB JERRYLABB) RMTLOCNAME(*LOOPBACK)

Back on the AR system we will create a test DDM file using the RDB entry we created for the AS system:

CRTDDMF FILE(JMCKEE/TEST) RMTFILE(QIWS/QCUSTCDT) RMTLOCNAME(*rdb) RDB(JERRYLABB)

Then test with: 

DSPPFM FILE(JMCKEE/TEST)